Fake login pages and portals built to capture passwords, MFA codes, or session cookies.
View All Tags
You have (11) pending message(s) stopped by the mail server from delivering due to low bandwidth. The report comes from the recipient's own address, the same sender's fourth lure of the evening. It lists invoices, an order and shipping documents without a single sender, blames bandwidth, and carries the same mail login link.
You're out of storage and may not receive new emails. The warning comes from the recipient's own address, the same sender's third lure in 83 minutes. It names no mail service, calls the mailbox full while its own figures leave about 40 MB free, and carries the same mail login link.
The delivery of messages was stopped by your domain mail server. The notice comes from the recipient's own address, 39 minutes after the same operator's fake login alert. It names none of its 15 messages, blames a server named after an IP address that cannot exist, and carries the same link.
We noticed some unusual login activity with your account. The alert comes from the recipient's own address, signed by a Mail Administrator who never names a mail service. It calls one attempt multiple, dates it two hours after the alert itself, leaves the IP address blank, and links to a page dressed as a mail login on a 17-year-old travel-business domain.
Your documents are ready kindly scan the can QR CODE to review and sign. A salary adjustment contract posing as the company's own HR department, sent from the postmaster mailbox of an unrelated domain, styled as DocuSign in the email and OneDrive in the PDF, with the company's name, logo and mailbox merged in — and a QR code as the only way in.
The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.
We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.
You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.
Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.
We couldn't renew your Cloud storage subscription because your payment method needs to be updated. A storage-full warning whose body is actually about a failed payment, sent from a domain on a top-level domain that does not exist, linking to a page parked inside a Google Cloud Storage bucket.
